Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2025-52998Chamilo: PHAR deserialization bypass

High 7.0

In plain English

A high-severity unsafe deserialization in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.30

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 x_refsource_MISC